Amazon Third-Party

[prophet01]

Which means Amazon at best will just need to confirm they hold the name and address of the recipient. They are not obliged to pass on the name of the sender.

How about explaining your rationale for your conclusion in the context of the GDPR.

 

[fisicx]

GDPR is about the PI someone holds about you. For example name, address, telephone, email.

The sender is not PI for @MrBillyBenson. Which means under GDPR they are not obliged to pass on this information.

An analogy. You can request the PI the local council holds about you. What they aren't required to do is tell you the name of the person who processes your council tax.

 

[UKSBD]

Data protection doesn't override privacy (or vise versa)

15(1)(g) is irrelevant if it means Amazon would have to provide information that goes against rights of freedom of privacy.

 

[DontAsk]

It most certainly is when it contains their name and address.

"1. ‘personal data’ means any information relating to an identified or identifiable natural person".​

The OP can only require Amazon to provide THEIR personal data. The identity of a sender is NOT the OPS personal data.

Er, where did I agree such a thing?
I've not only stated completely the oppposite but indicated where the legal requirement can be found.

Post #22

 

[prophet01]

@fisicx
@UKSBD
@DontAsk

Before I respond any further to your apparent challenges to my understanding of the GDPR may I enquire as to wether or not you've read the actual text of the GDPR and understand the acknowledged interpretation of the legislation.

I ask because the content of your questioning strongly suggests an ignorance of the most fundamental aspects of the GDPR.

 

[fisicx]

Before I respond any further to your apparent challenges to my understanding of the GDPR may I enquire as to wether or not you've read the actual text of the GDPR and understand the acknowledged interpretation of the legislation.

Yes I have.

The sender of the unsolicited goods in this case is not PI. It’s not even clear if they are a data controller or data processor as we don’t even know if this fulfilment by Amazon.

 

[UKSBD]

@fisicx
@UKSBD
@DontAsk

Before I respond any further to your apparent challenges to my understanding of the GDPR may I enquire as to wether or not you've read the actual text of the GDPR and understand the acknowledged interpretation of the legislation.

I ask because the content of your questioning strongly suggests an ignorance of the most fundamental aspects of the GDPR.

I know you can never rely on one line of any legal document without reading the whole document.

 

[DontAsk]

@fisicx
@UKSBD
@DontAsk

Before I respond any further to your apparent challenges to my understanding of the GDPR may I enquire as to wether or not you've read the actual text of the GDPR and understand the acknowledged interpretation of the legislation.

I acknowledge your interpretation but I disagree with it. Does that help?

 

[prophet01]

I acknowledge your interpretation but I disagree with it. Does that help?

Not really as you've proven yourself incapable of understanding and responding to my straightforward question

Before I respond any further to your apparent challenges to my understanding of the GDPR may I enquire as to wether or not you've read the actual text of the GDPR and understand the acknowledged interpretation of the legislation.

 

[prophet01]

Yes I have.

The sender of the unsolicited goods in this case is not PI. It’s not even clear if they are a data controller or data processor as we don’t even know if this fulfilment by Amazon.

Good grief. It's the order that's the OP's personal information as I've previously stated.
The Controller is Amazon.
Jeez, I give up.

 

[fisicx]

Good grief. It's the order that's the OP's personal information as I've previously stated.
The Controller is Amazon.
Jeez, I give up.

Nope. That’s not how it works. The actual order is not PI. The PI is the name and address it was sent to. The bag of nuts and bolts sent by Mr Wang in Beijing isn’t PI. It’s all detailed in the GDPR

 

[prophet01]

It’s all detailed in the GDPR

I'm always happy to stand corrected so please quote the GDPR text which you believe demonstrates your view to be accurate.

 

[fisicx]

What is personal data?

ico.org.uk

It lists what is PI. The details of a third party organisation isn’t PI. There could by some convoluted means be a case where the third party is a data controller but if it’s fulfilment by Amazon then this is unlikely. All Amazon is required to do is release The PI for the recipient of the goods.

 

[DontAsk]

THE OP DID NOT PLACE THE ORDER.

Not really as you've proven yourself incapable of understanding and responding to my straightforward question

Jeez. Of course I've read it, that's how I form my own interpretation and come to a disagreement

 

[prophet01]

The GDPR does not list what is personal information.

Article 4 GDPR Definitions

1. ‘personal data’ means any information relating to an identified or identifiable natural person

The important phrase is relating to.

In this instance the order is the information. It most definitly relates to the OP as it states his name and address, therfore the order is his personal information.

 

[fisicx]

In this instance the order is the information. It most definitly relates to the OP as it states his name and address, therfore the order is his personal information.

The order contains their personal data but the sender of the order is not personal data. Which means Amazon will say a bag of bird seed was sent to Mr Arbuthnot of Paisley but Amazon is not required to say from whom it was sent.

Until @MrBillyBenson has made the request and receive the answer we can't do much more. We differ in opinion - nothing wrong with that - but I suspect @MrBillyBenson won't get the information they required without a court order which Amazon will the contest.

 

[prophet01]

THE OP DID NOT PLACE THE ORDER.

So what. It's still his personal information as it relates to him.

Jeez. Of course I've read it, that's how I form my own interpretation and come to a disagreement

Anyone can simply disagree.

 

[prophet01]

The order contains their personal data but the sender of the order is not personal data.

I simply stated that the order is the OP's personal data, I made no mention of the sender's details.

As the order is the OP's personal data, as I believe I've demonstrated, he is entitled to request a copy of the order and Amazon are obliged to provide a copy of the order. It may well be that Amazon redact the name of the enity/individual who/which raised the order.

If that does happen then, as I've previously stated, Article 15(1)(g) could be relied upon,

In which case Article 15(1)(g) could be relied upon.
"where the personal data are not collected from the data subject, any available information as to their source".

The personal data being the order submitted by the third party to Amazon and processed by Amazon.

 

[prophet01]

Until @MrBillyBenson has made the request and receive the answer we can't do much more. We differ in opinion - nothing wrong with that - but I suspect @MrBillyBenson won't get the information they required without a court order which Amazon will the contest.

He has made the request. So yes, Amazon's response is awaited.

I also suspect that Amazon will not comply with the GDPR and will have to be forced to do so by judicial remedy.

 

[AlanJ1]

I also suspect that Amazon will not comply with the GDPR and will have to be forced to do so by judicial remedy.

Is it really worth it over finding out who sent him a package that cost no money? Seems to me this has blown up.

 

[prophet01]

Is it really worth it over finding out who sent him a package that cost no money? Seems to me this has blown up.

That's a decision the OP will have to make should Amazon decide to breach the GDPR by refusing to comply with Article 15(1)(g).

 

[prophet01]

@MrBillyBenson
If, as expected, you receive either a rejection/bullshit response from the people you're communicating with — who I suspect are simply following a set script — the next step is to go to Amazon's DPO who should take your request more seriously and address it properly.

Email the DPO at [email protected]

Tell them that your personal information was disclosed to Amazon for the purpose of placing an order and sending unsolicited goods to you.

Explain that your several requests to be informed of who disclosed your information to Amazon have been rejected/ignored despite you pointing out that GDPR Article 15(1)(g) obliges Amazon to do so.

I'd keep it this simple and to this single point. See what comes back.

 

[elaine@cheapaccounting]

Daft question (and it pay have already been asked ) ..... have you been charged for the goods?

 

[elaine@cheapaccounting]

That should be may not pay

 

[Paul Kelly ICHYB]

This general issue has been highlighted by the press over the past few weeks:

The 'brushing' scam that's behind mystery parcels

There's been a rise in sellers buying and sending out their own goods in order to boost sales and reviews.

www.bbc.co.uk